Silent Intrusion: Sophisticated Threat Actor Exploits Fake Job Offers and Video Calls for Malware Delivery

- Posted in Threat Analyze by
Background: In one of my previous articles, I covered the challenges associated with fake job interviews. This type of attack has also been leveraged by highly sophisticated groups. I would like to [...] Read more

Identifying the Root Cause of Cybersecurity Incidents Involving Exploit Detonation on Windows Machines

- Posted in Incident Response by
Background: During the incident response stage of "Log Collection," it is highly valuable to collect comprehensive data from the servers, especially when the affected system is running Windows OS. [...] Read more

Case Study: Tackling Extension Infections with a Budget-Friendly Scratch Project

- Posted in Threat Analyze by
Backgound: Following a notification from a company that fell victim to a supply chain attack, where attackers compromised their Chrome extension, I realized the importance of addressing this issue. [...] Read more

When APTs Knock on Your Wi-Fi: Real-World Lessons for Better Security

- Posted in Other by
Background: Recently, I came across a notification about a highly targeted attack against a U.S. company, where the attacker exploited a neighboring network to perform lateral movement into the [...] Read more

Strategies for Discovering C2 Servers During the Incident Response Log Collection and Analyze Stage

- Posted in Other by
Background: During malware analysis on assets, one of the best approaches is not only to focus on identifying the exact malware but also to look for signs of other malware based on external calls [...] Read more

Tracking Seized Domains: Checking Your Environment for Harmful Domain IOCs

- Posted in Threat Analyze by
Background: It’s no secret that international law enforcement agencies periodically seize domains linked to cyber threats, criminal activities, and other harmful purposes. Every cybersecurity [...] Read more

Weaponizing Trust: The Fight Against Signed Malicious Code

- Posted in Other by
Background: During the MITRE ATT&CK Initial Access stage (T1199), attackers often impersonate trusted sources to gain a foothold in the target environment. By originating their activities from [...] Read more

Scalable Snapshot Management in the Cloud for Windows and Linux Systems: Best Practices for Data Security and Forensics

- Posted in Incident Response by
Background: During a cybersecurity incident in the cloud, one of the mandatory steps is to take a snapshot of the machine that contains the threat, isolate it, and preserve the snapshot or filesystem [...] Read more

Technical Detection of Typo-Squatted Campaigns: A Case Study on Roblox Game Account Hijacking

- Posted in Threat Analyze by
Background: A few days ago, UNIT42 reported tracking an active phishing campaign targeting Roblox game players, which is hugely popular worldwide. In a previous article, I covered the broader threats [...] Read more

From Interviews to Infections: The Dangerous Trend of Cybercriminals in Job Recruitment

- Posted in Threat Analyze by
Background: Over the years, the tactics, techniques, and procedures (TTPs) of attackers have evolved significantly. Recently, APT groups have used new methods that have also been adopted by average [...] Read more
Page 9 of 11